registry / @spuentesp/lain-mcp / 0.4.2

@spuentesp/lain-mcp@0.4.2

Lain - Architectural code intelligence for AI coding agents

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.54 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 9-35json

9 "repository": {

10 "type": "git",

11 "url": "https://github.com/spuentesp/lain.git"

12 },

13 "bin": {

14 "lain": "./bin/lain.js"

15 },

16 "files": [

17 "bin/"

18 ],

19 "os": [

20 "darwin",

21 "linux",

22 "win32"

23 ],

24 "cpu": [

25 "x64",

26 "arm64"

27 ],

28 "scripts": {

29 "postinstall": "node scripts/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 },

31 "engines": {

32 "node": ">=18.0.0"

33 }

34}

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code